...
It is still possible for an attacker to obtain uninitialized instances of SensitiveClass by catching NotSerializableException or by using a finalizer attack, see OBJ11-J. Be wary of letting constructors throw exceptions for more information. Therefore any object of an unserializable class that extends a serializable class must always validate itself its fields before executing any methods.
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a70fb4a5930fcd4f-849ca226-49954042-b9789966-ca658c422a9460424616c594"><ac:plain-text-body><![CDATA[ | [[Bloch 2005 | AA. References#Bloch 05]] | Puzzle 83. Dyslexic monotheism | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="b7d7473678289711-f15285df-48f94eb9-9c488085-bb8ce2e69e2eb789c39d1a86"><ac:plain-text-body><![CDATA[ | [[Bloch 2001 | AA. References#Bloch 01]] | Item 1. Enforce the singleton property with a private constructor | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="45c8a53f9472c4a7-12b3d25d-41de4607-992b8a38-7dc2bf5b3dc7ddc448c976f4"><ac:plain-text-body><![CDATA[ | [[Greanier 2000 | AA. References#Greanier 00]] | [Discover the Secrets of the Java Serialization API | http://java.sun.com/developer/technicalArticles/Programming/serialization/] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="607cbe7c3e8c03f1-8dc2089d-4adc4235-af5c8ae5-837616fca4264274e994f6bd"><ac:plain-text-body><![CDATA[ | [[Harold 1999 | AA. References#Harold 99]] |
| ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0b9f29753b7e61c5-52a6193b-4576475b-bfafafe8-ba34d6f1f05b86d12500a33b"><ac:plain-text-body><![CDATA[ | [[JLS 2005 | AA. References#JLS 05]] | [Transient Modifier | http://java.sun.com/docs/books/jls/third_edition/html/classes.html#37020] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="1ac7e4742f8d3203-2ff290ab-449c4b00-99849cd1-409a2cd01ebd592440ff90c7"><ac:plain-text-body><![CDATA[ | [[Long 2005 | AA. References#Long 05]] | Section 2.4, Serialization | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="6061578bb67ce5c2-241e2a24-43174e77-9708955a-6146330e04f090bd2acbb330"><ac:plain-text-body><![CDATA[ | [[Sun 2006 | AA. References#Sun 06]] | Serialization Specification, A.4, Preventing Serialization of Sensitive Data | ]]></ac:plain-text-body></ac:structured-macro> |
...